Data Protection Policy

The data controller for personal information collected through the NOVAC platform is:

"NOVAC" refers to the AgriFAAS Connect investment platform operated by Cure Technologies. Any references to "we", "us", or "our" in this policy refer to Cure Technologies.

We process personal data in accordance with:

• Ghana Data Protection Act, 2012 (Act 843): The primary law governing data protection in Ghana, enforced by the Data Protection Commission.
• EU General Data Protection Regulation (GDPR): Applicable to users who are residents of the European Economic Area (EEA) or the United Kingdom.
• UK GDPR / Data Protection Act 2018: Applicable to users who are residents of the United Kingdom.

We collect the following categories of personal data:

We process your personal data on the following legal grounds:

• •Contract Performance: Processing is necessary to execute your investment, remittance, or partnership agreement with us.
• •Legal Obligation: We are required to collect and verify identity data (KYC/AML) under Ghanaian financial regulations.
• •Legitimate Interests: Fraud prevention, platform security, analytics, and improving our services — where our interests do not override your rights.
• •Consent: For marketing communications. You may withdraw consent at any time by updating notification preferences in Settings or emailing us.

• Registering and managing your investor or partner account
• Processing investment applications and verifying payments
• Executing remittance (money transfer) transactions
• Conducting KYC identity and document verification
• Generating investment contracts, receipts, and reports
• Sending transaction notifications, account alerts, and platform updates
• Detecting and preventing fraud, money laundering, and unauthorised access
• Complying with legal, regulatory, and audit requirements
• Providing customer support and resolving complaints
• Improving platform functionality and user experience (aggregated, anonymised analytics)

We never sell your personal data to third parties. We share data only where necessary:

• •Stripe & Paystack: PCI-DSS compliant payment processors for card and mobile money transactions.
• •Alchemy / Solana Network: Blockchain infrastructure for processing USDC cryptocurrency deposits.
• •Base44 Platform: Our hosting and database infrastructure provider, operating under strict data processing agreements.
• •Farm Hub Operators: Limited operational data (not personal identity data) shared with farm management teams for investment reporting.
• •Regulatory Authorities: Ghana Data Protection Commission, Financial Intelligence Centre, or law enforcement — only when required by law.
• •Professional Advisors: Lawyers, auditors, and accountants under strict confidentiality obligations.

All third-party processors are bound by data processing agreements requiring GDPR/Act 843-equivalent protections.

We retain your data for as long as necessary for the purposes stated, or as required by law:

After the retention period, data is securely deleted or anonymised.

We implement technical and organisational measures to protect your data:

• All data in transit is encrypted using TLS 1.2+ (HTTPS)
• Data at rest is encrypted using AES-256 on our database infrastructure
• Access to personal data is restricted to authorised personnel on a need-to-know basis
• Admin accounts and sensitive operations require multi-factor authentication
• Regular security reviews, vulnerability scanning, and penetration testing
• Audit logs record all administrative actions on user data
• Payment card data is never stored by NOVAC — processed exclusively by PCI-DSS certified processors (Stripe/Paystack)

Depending on your location, you have the following rights regarding your personal data:

To exercise any of these rights, email us at support@curetechnologies.org with subject line "Data Rights Request". We will respond within 30 days.

We use essential cookies to operate the platform (session management, security tokens). We do not use advertising or third-party tracking cookies.

• Session cookies: Required for login and platform functionality. Deleted when you close your browser.
• Security tokens: Prevent CSRF attacks and maintain authenticated sessions.
• No advertising, behavioural tracking, or third-party analytics cookies are used.

Your data is primarily stored on servers located within or processing under equivalent safeguards. Where data is transferred outside Ghana (e.g., to Stripe in the US, or Base44 infrastructure), we ensure appropriate safeguards are in place, including:

• •Standard Contractual Clauses (SCCs) approved by the European Commission
• •Data Processing Agreements with all third-party processors
• •Adequacy decisions or equivalent transfer mechanisms where applicable

The NOVAC platform is not intended for use by persons under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has created an account, please contact us immediately at support@curetechnologies.org and we will take prompt action to delete the data.

We may update this Data Protection Policy from time to time to reflect changes in law, technology, or our operations. Material changes will be communicated via email and an in-app notification at least 14 days before taking effect. The "last updated" date at the top of this page indicates when the policy was last revised.

Continued use of the platform after a policy update constitutes acceptance of the revised terms.